Best OSINT Tools for Company & Organization Investigation

Apollo.io

B2B contact and company intelligence

BuiltWith

Website technology profiling platform

DomainTools

Enterprise domain and DNS intelligence

GitHub User Search

Search public GitHub users and repos

Google Maps

Maps, places, and street-level imagery

Have I Been Pwned

Check exposure in known data breaches

Hunter.io

Find and verify professional emails

LinkedIn Search

Search people and companies on LinkedIn

Maltego

Visual OSINT link-analysis platform

Recon-ng

Modular web reconnaissance framework

SecurityTrails

DNS history and domain intelligence platform

Wappalyzer

Detect technologies used by websites

Wayback Machine

View archived versions of web pages

theHarvester

Collect emails and subdomains from public sources

AADInternals

Recon Azure AD / M365 tenant info from a domain

AIHIT

Company database with registration and contact data

AeroLeads

a prospecting platform for finding business emails, phone numbers, and compan

Africa OSINT Toolbox

Africa-focused OSINT directory by ANCIR

Airfleets

Airline fleet and aircraft history database

Airframes.org

Long-running aircraft registration history

Altdns

a subdomain permutation tool that generates altered hostnames for DNS brute f

Anymail Finder

an email discovery and verification platform for finding deliverable professi

Apache Tika

Extract text and metadata from any document type

Archive.is

Archive web pages for evidence

Archive.today

Create permanent web page snapshots

ArchiveBox

a self-hosted web archiving system for saving pages, media, PDFs, and browser

Arjun

an HTTP parameter discovery tool for finding hidden inputs accepted by web ap

Assetfinder

a command-line tool for finding domains and subdomains related to a target or

Australian Charities and Not-for-profits Commission

Australian charity register

B2BHint

Global company registry and owner search

BAILII

Free UK/Ireland/EU legal information archive

Babel Street

Multilingual OSINT and PAI platform

Bizapedia

US multi-state business registry aggregator

Bloomberg Terminal

Bloomberg financial workstation (subscriber)

BoletinOficial.gob.ar

Argentine official gazette full-text search

Brandwatch

Social intelligence and monitoring platform

Brazil Receita Federal CNPJ

Brazilian CNPJ company registration lookup

BuiltWith Trends

Web technology adoption trend data

CB Insights

Private-company tech intelligence platform

CIPC South Africa BizPortal

South African company registry lookup

CMSeeK

a CMS detection and exploitation-aid tool for identifying website platforms a

CONSULTA CNPJ

Free Brazilian CNPJ aggregator

CanLII

Free search of Canadian court decisions and legislation

Capital IQ

S&P Global financial-data terminal

CentralOps

Web toolkit for WHOIS, DNS, and IP network lookups

Cobalt Intelligence

US/Canadian SOS scraping API

Coface ICON

Coface corporate credit-risk platform

Common Crawl

a public web crawl archive used to research historical web content and large-

Companies House

the UK company register for searching companies, officers, filings, and corpo

Companies House API

Free UK Companies House REST API

Conifer

a web archiving service for capturing interactive pages and preserving browsi

ContactOut

a recruiting and contact search platform for finding professional emails and

Corporations Canada Search

Official search of federally incorporated Canadian companies

CourtListener

a legal search platform for U.S. court opinions, dockets, judges, and oral ar

Crunchbase

Startup funding and corporate data platform

DNSDumpster

Passive DNS and subdomain reconnaissance

DNSRecon

a DNS enumeration script for records, zone transfers, brute force, and cache

DNSValidator

a resolver validation tool used to build reliable DNS resolver lists for reco

Data.gov

a U.S. government open data catalog for datasets across agencies and public p

Datanyze

B2B technographic and contact platform